CVE-2026-16492
Full vulnerability record from the local CVENow database.
Description
A weakness has been identified in umijs umi up to 4.6.63. The affected element is the function git.getFileCreateInfo of the file packages/utils/src/getFileGitIno.ts of the component GIT File Helper. This manipulation causes os command injection. The exploit has been made available to the public and could be used for attacks. Upgrading to version 4.6.64 is sufficient to fix this issue. Patch name: b6da12c17b024a43badb1fa565720c38cf42e647. Upgrading the affected component is advised.
Severity
LOW
CVSS score
2.0
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-07-22 01:16:26.257000
Last modified
2026-10-24 17:10:00.220000
View original CVE JSON
{
"id": "CVE-2026-16492",
"sourceIdentifier": "[email protected]",
"published": "2026-07-22T01:16:26.257",
"lastModified": "2026-10-24T17:10:00.220",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in umijs umi up to 4.6.63. The affected element is the function git.getFileCreateInfo of the file packages/utils/src/getFileGitIno.ts of the component GIT File Helper. This manipulation causes os command injection. The exploit has been made available to the public and could be used for attacks. Upgrading to version 4.6.64 is sufficient to fix this issue. Patch name: b6da12c17b024a43badb1fa565720c38cf42e647. Upgrading the affected component is advised."
},
{
"lang": "es",
"value": "Se ha identificado una debilidad en umijs umi hasta la versión 4.6.63. El elemento afectado es la función git.getFileCreateInfo del archivo packages/utils/src/getFileGitIno.ts del componente GIT File Helper. Esta manipulación causa inyección de comandos del sistema operativo. El exploit se ha hecho público y podría ser utilizado para ataques. Actualizar a la versión 4.6.64 es suficiente para solucionar este problema. Nombre del parche: b6da12c17b024a43badb1fa565720c38cf42e647. Se aconseja actualizar el componente afectado."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "umijs",
"product": "umi",
"cpes": [
"cpe:2.3:a:umijs:umi:*:*:*:*:*:*:*:*"
],
"modules": [
"GIT File Helper"
],
"versions": [
{
"version": "4.6.0",
"status": "affected"
},
{
"version": "4.6.1",
"status": "affected"
},
{
"version": "4.6.2",
"status": "affected"
},
{
"version": "4.6.3",
"status": "affected"
},
{
"version": "4.6.4",
"status": "affected"
},
{
"version": "4.6.5",
"status": "affected"
},
{
"version": "4.6.6",
"status": "affected"
},
{
"version": "4.6.7",
"status": "affected"
},
{
"version": "4.6.8",
"status": "affected"
},
{
"version": "4.6.9",
"status": "affected"
},
{
"version": "4.6.10",
"status": "affected"
},
{
"version": "4.6.11",
"status": "affected"
},
{
"version": "4.6.12",
"status": "affected"
},
{
"version": "4.6.13",
"status": "affected"
},
{
"version": "4.6.14",
"status": "affected"
},
{
"version": "4.6.15",
"status": "affected"
},
{
"version": "4.6.16",
"status": "affected"
},
{
"version": "4.6.17",
"status": "affected"
},
{
"version": "4.6.18",
"status": "affected"
},
{
"version": "4.6.19",
"status": "affected"
},
{
"version": "4.6.20",
"status": "affected"
},
{
"version": "4.6.21",
"status": "affected"
},
{
"version": "4.6.22",
"status": "affected"
},
{
"version": "4.6.23",
"status": "affected"
},
{
"version": "4.6.24",
"status": "affected"
},
{
"version": "4.6.25",
"status": "affected"
},
{
"version": "4.6.26",
"status": "affected"
},
{
"version": "4.6.27",
"status": "affected"
},
{
"version": "4.6.28",
"status": "affected"
},
{
"version": "4.6.29",
"status": "affected"
},
{
"version": "4.6.30",
"status": "affected"
},
{
"version": "4.6.31",
"status": "affected"
},
{
"version": "4.6.32",
"status": "affected"
},
{
"version": "4.6.33",
"status": "affected"
},
{
"version": "4.6.34",
"status": "affected"
},
{
"version": "4.6.35",
"status": "affected"
},
{
"version": "4.6.36",
"status": "affected"
},
{
"version": "4.6.37",
"status": "affected"
},
{
"version": "4.6.38",
"status": "affected"
},
{
"version": "4.6.39",
"status": "affected"
},
{
"version": "4.6.40",
"status": "affected"
},
{
"version": "4.6.41",
"status": "affected"
},
{
"version": "4.6.42",
"status": "affected"
},
{
"version": "4.6.43",
"status": "affected"
},
{
"version": "4.6.44",
"status": "affected"
},
{
"version": "4.6.45",
"status": "affected"
},
{
"version": "4.6.46",
"status": "affected"
},
{
"version": "4.6.47",
"status": "affected"
},
{
"version": "4.6.48",
"status": "affected"
},
{
"version": "4.6.49",
"status": "affected"
},
{
"version": "4.6.50",
"status": "affected"
},
{
"version": "4.6.51",
"status": "affected"
},
{
"version": "4.6.52",
"status": "affected"
},
{
"version": "4.6.53",
"status": "affected"
},
{
"version": "4.6.54",
"status": "affected"
},
{
"version": "4.6.55",
"status": "affected"
},
{
"version": "4.6.56",
"status": "affected"
},
{
"version": "4.6.57",
"status": "affected"
},
{
"version": "4.6.58",
"status": "affected"
},
{
"version": "4.6.59",
"status": "affected"
},
{
"version": "4.6.60",
"status": "affected"
},
{
"version": "4.6.61",
"status": "affected"
},
{
"version": "4.6.62",
"status": "affected"
},
{
"version": "4.6.63",
"status": "affected"
},
{
"version": "4.6.64",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 2.0,
"baseSeverity": "LOW",
"attackVector": "ADJACENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "ADJACENT_NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.1,
"impactScore": 3.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:A/AC:L/Au:S/C:P/I:P/A:P",
"baseScore": 5.2,
"accessVector": "ADJACENT_NETWORK",
"accessComplexity": "LOW",
"authentication": "SINGLE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"availabilityImpact": "PARTIAL"
},
"baseSeverity": "MEDIUM",
"exploitabilityScore": 5.1,
"impactScore": 6.4,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-22T13:02:01.315106Z",
"id": "CVE-2026-16492",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-77"
},
{
"lang": "en",
"value": "CWE-78"
}
]
}
],
"references": [
{
"url": "https://github.com/umijs/umi/",
"source": "[email protected]"
},
{
"url": "https://github.com/umijs/umi/commit/b6da12c17b024a43badb1fa565720c38cf42e647",
"source": "[email protected]"
},
{
"url": "https://github.com/umijs/umi/issues/13345",
"source": "[email protected]"
},
{
"url": "https://github.com/umijs/umi/pull/13347",
"source": "[email protected]"
},
{
"url": "https://github.com/umijs/umi/releases/tag/v4.6.64",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/cve/CVE-2026-16492",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/submit/860128",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/380948",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/380948/cti",
"source": "[email protected]"
}
]
}